CVE-2026-90297

What it actually does

Inconsistent error handling in sun4i_crtc_init() returns NULL on layer initialization failure instead of an ERR_PTR, allowing the caller sun4i_tcon_bind() to proceed with a NULL crtc pointer that is later dereferenced in drm_crtc_mask() by sun4i_rgb_init() or sun4i_lvds_init(), resulting in a kernel NULL pointer dereference and oops.

Why it matters to the business

Systems using affected Allwinner DRM display hardware may experience unexpected kernel crashes during graphics initialization, leading to system instability, denial of service, and potential data loss on reboot if the failure path is triggered.

How an attack unfolds

An attacker with local access or the ability to influence display hardware initialization triggers the layer initialization failure path; the NULL return is not caught by IS_ERR(), the crtc remains NULL, and subsequent dereference in drm_crtc_mask() causes an immediate kernel panic.

How to fix it

Update to a Linux kernel containing the fix that changes sun4i_crtc_init() to consistently return an error pointer on failure; rebuild and deploy the corrected kernel image on affected Allwinner-based systems.

How to confirm the fix worked

Verify the kernel source contains the corrected sun4i_crtc_init() return semantics, confirm sun4i_tcon_bind() error paths now properly propagate failures, and test that graphics initialization succeeds without NULL dereference on the target hardware.

Typical attack path

1. Gain local execution or control display subsystem initialization
2. Force sun4i_crtc_init() layer setup to fail
3. Bypass IS_ERR() check in sun4i_tcon_bind()
4. Trigger sun4i_rgb_init() or sun4i_lvds_init() to call drm_crtc_mask() on NULL pointer
5. Induce kernel oops and system crash

How to detect it

Review kernel logs for oops or panic messages referencing sun4i, drm_crtc_mask, or NULL pointer dereference during early display initialization; correlate with boot timelines showing failed crtc setup.

What your security team should do

• Prioritize kernel update on all systems exposing sun4i DRM hardware within standard patch windows
• Monitor upstream stable kernel releases for backported fixes
• Audit local kernel configurations for unnecessary sun4i display drivers and disable if unused